a command line packet analyzer

learn more… | top users | synonyms

14
votes
1answer
11k views

Buffer size for capturing packets in kernel space?

Going through the man page of tcpdump, it seems kernel can drop the packets if the buffer is full. I was wondering if: that size is configurable and/or where can I see the size for my distro? From ...
3
votes
2answers
269 views

tcpdump : lost packets

Running, either in promiscuous mode or not : tcpdump -i "$INTERFACE" -vvv -n -XX -S -s0 -e I got a bunch of lines and this conclusion when I stopped it : 601 packets captured 938 packets received ...
23
votes
3answers
26k views

Why would the kernel drop packets?

I interrupted tcpdump with Ctrl+C and got this total summary: 579204 packets captured 579346 packets received by filter 142 packets dropped by kernel What are the "packets dropped by kernel"? Why ...
4
votes
1answer
2k views

How to recover a file from a tcpdump?

I use tcpdump -i wlan0 -s 0 dst 192.168.1.200 or src 192.168.1.200 -w output.pcap to monitor for ex.: my HTTP traffic. I upload a .zip file through HTTP. How can I retrieve the .zip file from the ...
14
votes
4answers
17k views

How to process/pipe TCPDUMPs output in realtime

If I want to tcpdump DNS requests by clients (on an OpenWrt 10.04 router), then I root@ROUTER:/etc# tcpdump -n -i br-lan dst port 53 2>&1 tcpdump: verbose output suppressed, use -v or -...
3
votes
1answer
2k views

Is it possible to capture all network traffic using tcpdump?

I have 3 computers on the same sub-net. Computer A and B are communicating with each other (ping, telnet, etc.). I'd like to see the packets between A and B on computer C. Is it possible to do this ...
1
vote
3answers
2k views

using “-vvv” with “-w FILENAME” with tcpdump makes better output?

Does it makes a more detailed output if I use tcpdump -vvv -w FILENAME vs. if I use: tcpdump -w FILENAME or it doesn't makes any sense if I use the "-vvv" when I'm using "-w FILENAME"?